mcc-api-tools/request-object-bundle
A Symfony bundle for turning incoming HTTP requests into typed request objects. Centralize validation, mapping, and input handling so controllers stay clean, reusable, and easier to test across API endpoints and request workflows.
Architecture fit. The naming and repository structure indicate this is a Symfony bundle, not a Laravel package — the Bundle suffix, the iliabox namespace, and the typical Symfony DependencyInjection/*Extension + services.yaml layout are the giveaway. Laravel has no concept of a bundle; it uses service providers, facades, and container bindings. So the nominal "integration" between this package and a Laravel application is effectively zero — there is no RequestObjectServiceProvider, no config publishing, no auto-discovery. The underlying pattern (a plain-old-PHP-object wrapping an HTTP request into a typed, validated value object) is framework-agnostic and valuable, but that value lives in maybe one or two classes carrying an MIT license, not in the bundle scaffolding.
Integration feasibility. Two paths exist. (1) composer require the bundle and let it pull Symfony contracts/http-foundation as transitive dependencies into a Laravel app — technically possible, but you are importing a parallel framework substrate for a class you could copy in ten minutes. (2) Vendor the RequestObject base class (or interface) directly into app/Support/ with an MIT attribution header and wire it to Laravel's container and validator yourself. Path 2 is almost certainly the correct call. Confirm by reading the source — if the bundle's total logic is under ~200 LOC and consists of a base class plus one compiler pass, the bundle wrapper is dead weight.
Technical risk. High, on provenance grounds. One star, zero dependents, and a single-maintainer repo mean no downstream battle-testing and no community pressure on correctness or security. The release date of 2026-07-07 is a red flag worth resolving before anything else — either the metadata is wrong, the system clock is skewed, or the version is being tagged speculatively. In all three cases, treat the version provenance as unverified. Additional unknowns: PHP version constraint in composer.json, which Symfony major versions are supported, whether a test suite exists at all, and whether the "RequestObject" is a POPO or leaks Symfony's Request object into its API (which would defeat the portability argument entirely).
Key questions for the maintainer or code review.
symfony/http-foundation or symfony/http-kernel?Stack fit. Low as a dependency, moderate as a code source. The package does not slot into Laravel's request lifecycle — FormRequest, middleware, and the validator are the idiomatic lanes, and this bundle predates and ignores them. Adopting it wholesale would create a second request-handling abstraction competing with FormRequest, which is exactly the kind of dual abstraction that erodes codebase coherence over time.
Migration path. Recommended sequence: (1) a one-day spike reading the source and rewriting the core class as a Laravel-native DTO; (2) if the spike confirms the logic is trivial, do not add the dependency at all — vendor the class with attribution; (3) if it turns out to be richer than expected (e.g., nested request objects, coercion rules, error aggregation), fork it into an internal package under our namespace so we control the release cadence. There is no migration from anything here — no existing consumers, no data to move.
Compatibility. Must be verified before any adoption: the declared PHP constraint against our runtime, and whether the Symfony contracts it pulls conflict with anything else in the lockfile. Laravel ships with symfony/* components of its own; adding a bundle with a divergent constraint is a realistic way to trigger a Composer resolution failure or, worse, a silent downgrade of a shared component.
Sequencing. Do the source read before the commercial or architectural decision. Everything downstream — vendor, fork, or skip — depends on one question: how much code is actually in here? Given a score of ~14/100 and zero dependents, the prior should be that the answer is "very little," and the correct output of the spike is a documented internal pattern rather than a new vendor line.
Maintenance. If adopted as a dependency, we inherit an unmaintained one. With one star and zero dependents there is no realistic prospect of upstream security patching, and a single maintainer is a bus-factor of one. Practically, adoption equals forking — so budget for it as an internal package from day one, with an owner, a changelog, and a review cadence. If vendored, the maintenance cost is near zero, but so is the leverage.
Support. None commercially or communally. No vendor SLA, no active issue triage to rely on, no Stack Overflow corpus. Any production incident traced to this code is ours to diagnose from source.
Scaling. Runtime cost is a non-issue — request objects are constructed once per request and are plain PHP; there is no I/O, no caching layer, no memory residency. The scaling concern is entirely organizational: how many teams will independently reinvent this pattern if we don't standardize on something.
Failure modes. The realistic ones are (a) Composer constraint conflict with Laravel's bundled Symfony components surfacing at deploy time; (b) silent divergence if we fork and stop tracking upstream; (c) the future-dated release indicating a broken or automated tag pipeline that could later publish an unexpected version; (d) lockfile drift if the package is installed but unused. None are catastrophic; all are avoidable by not installing it.
Ramp-up. Low. The API surface is small and the pattern is familiar to any PHP engineer who has written a DTO. A new team member can be productive with the internal equivalent in under an hour. This low ramp-up is itself an argument that buying (or even borrowing) the abstraction yields little — the cost we are trying to avoid is negligible.
Recommendation. Do not add this as a runtime dependency. Read the source, extract the pattern, and implement a small internal request-object convention aligned with Laravel's validator. Revisit only if the package turns out to contain substantially more logic than the description suggests.
How can I help you explore Laravel packages today?